Possible Outlook Virus/Trojan

[Gilbert T. Gutierrez, Jr.]

XP
Outlook 2007 (Using IMAP)
AVG 8.0 Network Edition

My computer seems to be originating spam via outlook. Below are a list of
symptoms...

1. When I open Outlook in the morning I will get several email bounce
messages with my computer, mail server information, and outlook version in
the original message header with the content being some form of volgar
message.
2. If I access my email through the web interface of my mail server, I do
not get any of the bounce backs.
3. If I change my SMTP mail server to localhost in Outlook before opening
Outlook, Send and Receive tells me it cannot send 6 messages even though
there are no messages in the outbox.
4. This "virus/trojan" only generates mail once during the day (when Outlook
is first powered on). If Outlook is closed after the initial send and the
hidden messages are sent, the virus will not attempt to send or generate any
more messages that are not in the outbox. It seems that the virus seems to
have a clock associated with it as well as a trigger of Outlook opening.

I have tried a couple online virus scanners along with Malwarebytes'
Anti-Malware and the upto date copy of AVG. Nothing seems to catch the
problem. This issue has been occuring for a week or 2.

Thank you.

 

[Gilbert T. Gutierrez, Jr.]

Found a message with a couple of other people having this same problem
several pages back with the title "Outlook says sending messages but no
messages". There is no solution to their message either.

I am sorry about the duplicate post.

 

[Gilbert T. Gutierrez, Jr.]

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-10-02 09:34:58
Windows 5.1.2600 Service Pack 3


---- User code sections - GMER 1.0.14 ----

..text C:\WINDOWS\system32\SearchIndexer.exe[2512] kernel32.dll!WriteFile
7C810E17 7 Bytes JMP 00585C0C
C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 42F0F301
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 430A1667
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 430A15E8
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 430A162C
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 430A1574
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 430A15AE
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 430A16A2
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\Program Files\Internet Explorer\iexplore.exe[2664]
USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 42F316B6
C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
..text C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE[5492]
kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 5 Bytes JMP 3260531D
C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007
Microsoft Office component/Microsoft Corporation)

---- Devices - GMER 1.0.14 ----

Device \Driver\Tcpip \Device\Ip
avgtdix.sys (AVG Network connection watcher/AVG
Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Tcp
avgtdix.sys (AVG Network connection watcher/AVG
Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Udp
avgtdix.sys (AVG Network connection watcher/AVG
Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\RawIp
avgtdix.sys (AVG Network connection watcher/AVG
Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\IPMULTICAST
avgtdix.sys (AVG Network connection watcher/AVG
Technologies CZ, s.r.o.)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer
tfsnifs.sys (Drive Letter Access Component/Sonic
Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer
tfsnifs.sys (Drive Letter Access Component/Sonic
Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer
tfsnifs.sys (Drive Letter Access Component/Sonic
Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer
tfsnifs.sys (Drive Letter Access Component/Sonic
Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer
tfsnifs.sys (Drive Letter Access Component/Sonic
Solutions)
Device \FileSystem\Cdfs \Cdfs
tfsnifs.sys (Drive Letter Access Component/Sonic
Solutions)

---- Registry - GMER 1.0.14 ----

Reg
HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016410b8565

Reg
HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0016410b8565


---- EOF - GMER 1.0.14 ----

 

[Gilbert T. Gutierrez, Jr.]

StartupList report, 10/2/2008, 9:11:52 AM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16705)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Bluetooth Manager.lnk = ?
Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

BluetoothAuthenticationAgent = rundll32.exe
bthprops.cpl,,BluetoothAuthenticationAgent
IntelZeroConfig = "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
IntelWireless = "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel
PROSet/Wireless
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
Dell QuickSet = C:\Program Files\Dell\QuickSet\quickset.exe
dla = C:\WINDOWS\system32\dla\tfswctrl.exe
Apoint = C:\Program Files\Apoint\Apoint.exe
WD Spindown Utility = "C:\Program Files\Western Digital
Technologies\Spindown\ExSpinDn.exe"
ISUSPM = "C:\Program Files\Common
Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe"
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
AppleSyncNotifier = C:\Program Files\Common Files\Apple\Mobile Device
Support\bin\AppleSyncNotifier.exe
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
AVG8_TRAY = C:\PROGRA~1\AVG\AVG8\avgtray.exe
itype = "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
IntelliPoint = "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
VirtualCloneDrive = "C:\Program Files\Elaborate
Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall
%SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE
/CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB
/CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = c:\WINDOWS\system32\Rundll32.exe
c:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=avgrsstx.dll

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\scrnsave.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

..lnk: HIDDEN! (arrow overlay: yes)
..pif: HIDDEN! (arrow overlay: yes)
..exe: not hidden
..com: not hidden
..bat: not hidden
..hta: not hidden
..scr: not hidden
..shs: HIDDEN!
..shb: HIDDEN!
..vbs: not hidden
..vbe: not hidden
..wsh: not hidden
..scf: HIDDEN! (arrow overlay: NO!)
..url: HIDDEN! (arrow overlay: yes)
..js: not hidden
..jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
WormRadar.com IESiteBlocker.NavFilter - C:\Program
Files\AVG\AVG8\avgssie.dll - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
(no name) - C:\WINDOWS\system32\dla\tfswshx.dll -
{5CA3D70E-1895-11CF-8E15-001234567890}
(no name) - C:\Program Files\Microsoft
Office\Office12\GrooveShellExtensions.dll -
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
(no name) - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll -
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program
Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

--------------------------------------------------

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job
Microsoft_Hardware_Launch_IPoint_exe.job
Microsoft_Hardware_Launch_IType_exe.job

--------------------------------------------------

Enumerating Download Program Files:

[SysProWmi Class]
InProcServer32 = C:\WINDOWS\system32\Dell\SystemProfiler\SysPro.ocx
CODEBASE = http://support.dell.com/systemprofiler/SysPro.CAB

[Office Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\OGACheckControl.DLL
CODEBASE =
http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

[Trend Micro ActiveX Scan Agent 6.6]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Housecall_ActiveX.dll
CODEBASE =
http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab

[Symantec AntiVirus scanner]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll
CODEBASE = http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

[Scanner.SysScanner]
CODEBASE = http://i.dell.com/images/global/js/scanner/SysProExe.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE =
http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1203895812484

[Symantec RuFSI Utility Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
CODEBASE =
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE =
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222362431609

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE =
http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc4.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\WINDOWS\system32\wshbth.dll
NameSpace #5: C:\Program Files\Bonjour\mdnsNSP.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

AEGIS Protocol (IEEE 802.1x) v3.6.0.0: system32\DRIVERS\AegisP.sys (autostart)
Apple Mobile Device: "C:\Program Files\Common Files\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe" (autostart)
Ati HotKey Poller: %SystemRoot%\system32\Ati2evxx.exe (autostart)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
AVG8 WatchDog: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (autostart)
AVG8 Network Redirector: \SystemRoot\System32\Drivers\avgtdix.sys (autostart)
Broadcom ASF IP monitoring service v6.0.4: C:\WINDOWS\system32\basfipm.exe
(autostart)
BASFND: \??\C:\WINDOWS\system32\Drivers\BASFND.sys (autostart)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe
-k netsvcs (autostart)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Bluetooth Support Service: %SystemRoot%\system32\svchost.exe -k bthsvcs
(autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs
(autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch
(autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
drvnddm: system32\drivers\drvnddm.sys (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
Intel(R) PROSet/Wireless Event Log: C:\Program
Files\Intel\Wireless\Bin\EvtEng.exe (autostart)
Fax: %systemroot%\system32\fxssvc.exe (autostart)
Google Updater Service: "C:\Program Files\Google\Common\Google
Updater\GoogleUpdaterService.exe" (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService
(autostart)
mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)
Net Logon: %SystemRoot%\system32\lsass.exe (autostart)
NICCONFIGSVC: C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
Intel(R) PROSet/Wireless Registry Service: C:\Program
Files\Intel\Wireless\Bin\RegSrvc.exe (autostart)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss
(autostart)
Intel(R) PROSet/Wireless Service: C:\Program
Files\Intel\Wireless\Bin\S24EvMon.exe (autostart)
WLAN Transport: system32\DRIVERS\s24trans.sys (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs
(autostart)
Windows Firewall/Internet Connection Sharing (ICS):
%SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs
(autostart)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc
(autostart)
tfsnboio: system32\dla\tfsnboio.sys (autostart)
tfsncofs: system32\dla\tfsncofs.sys (autostart)
tfsndrct: system32\dla\tfsndrct.sys (autostart)
tfsndres: system32\dla\tfsndres.sys (autostart)
tfsnifs: system32\dla\tfsnifs.sys (autostart)
tfsnopio: system32\dla\tfsnopio.sys (autostart)
tfsnpool: system32\dla\tfsnpool.sys (autostart)
tfsnudf: system32\dla\tfsnudf.sys (autostart)
tfsnudfa: system32\dla\tfsnudfa.sys (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k
netsvcs (autostart)
VMware Converter Service: "C:\Program Files\VMware\VMware
Converter\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Converter\\" -s
ufad-p2v.xml (autostart)
Vstor2 P2V30 Virtual Storage Driver: \??\C:\Program Files\VMware\VMware
Converter\vstor2-p2v30.sys (autostart)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k
netsvcs (autostart)
Intel(R) PROSet/Wireless SSO Service: C:\Program
Files\Intel\Wireless\Bin\WLKeeper.exe (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Windows Search: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)


--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
End of report, 18,430 bytes
Report generated in 0.281 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

[Gilbert T. Gutierrez, Jr.]

Active Application Add-ins
MapPoint Office Add-In | C:\Program Files\Common Files\Microsoft
Shared\Geography\MPOAI9.dll
Microsoft Exchange Unified Messaging | C:\Program Files\Microsoft
Office\Office12\ADDINS\UmOutlookAddin.dll
Microsoft Office Groove Proxy for Outlook Add-in | C:\Program
Files\Microsoft Office\Office12\GrooveTransceiver.dll
Microsoft Office SharePoint Server Colleague Import Add-in | C:\Program
Files\Microsoft Office\Office12\ADDINS\CollegueImport.dll
Microsoft Outlook Mobile Service | C:\Program Files\Microsoft
Office\Office12\OMSMAIN.DLL
OneNote Notes about Outlook Items | C:\Program Files\Microsoft
Office\Office12\ONBttnOL.dll
Windows Search Email Indexer | C:\WINDOWS\system32\mssphtb.dll

Inactive Application Add-ins
iTunes Outlook Addin | C:\Program Files\iTunes\iTunesOutlookAddIn.dll
Microsoft Access Outlook Add-in for Data Collection and Publishing |
C:\Program Files\Microsoft Office\Office12\ADDINS\ACCOLK.DLL
Microsoft VBA for Outlook Addin | C:\Program Files\Microsoft
Office\Office12\ADDINS\OUTLVBA.DLL
Outlook Change Notifier | C:\Program Files\Common Files\Apple\Mobile
Device Support\bin\OutlookChangeNotifierAddIn.dll

Disabled Application Add-ins
<none>